Setup Assistant with Modern Auth for ADE (iOS/iPadOS 13+ and macOS 10.15+) - Int...

We’re excited to announce support for a new authentication method for Automated Device Enrollment (ADE) which is Setup Assistant with Modern Authentication. This new authentication method will be available for iOS/iPadOS devices running 13.0 and later and for macOS devices running 10.15 and later, in public preview in Microsoft Endpoint Manager.

Overview

This new authentication method for automated device enrollment will allow your organization to require authentication with Azure AD (required) and multi-factor authentication (optional) in order to successfully enroll the device. The end user will be required to authenticate with their Azure AD credentials during Setup Assistant, with an additional Azure AD login to the Company Portal after enrollment. If the admin has a Conditional Access policy that requires multi-factor authentication (at enrollment only, or enrollment and Company Portal login) then MFA will be required, otherwise it is optional. This will benefit organizations that are looking to require authentication in the out-of-box experience (OOBE) during enrollment in the Setup Assistant screens prior to users accessing the home screen.

Enrollment is completed once the user lands on the home screen, and users can freely use the device for resources not protected by Conditional Access. User affinity is established when users complete the additional Azure AD login into the Company Portal app on the device. That additional Azure AD login to the Company Portal app completes Azure AD registration, which establishes user affinity between the device user and Intune. Once user device affinity is established, the device will show up in the given user’s device list in the Azure AD portal since device identity association is established upon a successful login into the Company Portal.

When creating an Automated Device Enrollment profile, you'll be able to choose a new authentication method: Setup Assistant with modern authentication (preview). This method provides all the security from authenticating with the Company Portal but avoids the issue of leaving end users stuck on a device they can't use while the Company Portal installs on the device. With this new authentication method, the user has to authenticate using Azure AD credentials during the setup assistant screens. This will require an additional Azure AD login post-enrollment in in the Company Portal app to gain access to corporate resources protected by Conditional Access. The correct Company Portal version will automatically be sent down as a required app to the device for iOS/iPadOS, which we recommend choosing a VPP token for the enrollment profile. Otherwise, it will be sent down if the end user completes setting up their Apple ID during the Setup Assistant screens. For macOS, here are the options to get the Company Portal on the device - Add the Company Portal for macOS app - Microsoft Intune | Microsoft Docs.

If the admin configures a Conditional Access policy to require multi-factor authentication (MFA), then the end user will need a second device to complete MFA. Multi-factor authentication is optional based on the configuration of the MFA Azure AD settings.

Company Portal Redirection

A new improvement we’ve made to our onboarding experience helps guide end users to complete that second Azure AD authentication by automatically redirecting to the iOS/iPadOS Company Portal when the user attempts to access corporate data.

If users open any managed iOS/iPadOS applications that are protected by Conditional Access and they haven't completed the additional Azure AD login into the iOS/iPadOS Company Portal, they will be redirected to the iOS/iPadOS Company Portal from those other apps as part of this new change. This way, users will know exactly where to go to get access to resources protected by Conditional Access and will be guided to complete that last step.

Here is what it will look like if the end user tries to open any app protected by Conditional Access before authenticating in the Company Portal –

Conditional Access block screen

System prompt that opens the iOS/iPadOS Company Portal

Configuration in Microsoft Endpoint Manager admin center

Learn how to configure the new Setup Assistant with Modern Authentication for iOS/iPadOS and macOS in the Microsoft Endpoint Manager admin center by reading Enroll iOS/iPadOS devices by using ADE - Microsoft Intune | Microsoft Docs and Enroll macOS devices - Apple Business Manager or Apple School Manager | Microsoft Docs. Within the MEM admin center, you can control where a user is prompted for multi-factor authentication using different cloud apps when creating a Conditional Access policy. The following screenshot provides an example of the prompt locations:

MFA Prompt Locations for Microsoft Intune and Microsoft Intune Enrolment

Using the enrolled device as user-less (device without user device affinity)

For both iOS/iPadOS and macOS, user device affinity is established with the additional Azure AD login to the Company Portal app as mentioned above. That is also when device compliance is assessed, and the device shows up as compliant in the Microsoft Endpoint Manager admin center. If you would like to keep the device as enrolled with Intune but without user device affinity, that is also supported.

Once enrollment is completed during Setup Assistant, the end user lands on the home screen and can freely use the device. If there are no resources protected by Conditional Access and if Azure AD registration is not required, then this authentication method can be used to fully enroll the device as a user-less device. Note the following device behavior if you choose this automated device enrollment flow without guiding end users to login to the Company Portal post enrollment:

• The device will not show up in a given user’s device list in the Azure AD portal/admin center (since there is no device identity association).
• The device will not show up as compliant in the Microsoft Endpoint Manager admin center.

Keep in my mind

• If you choose "Setup assistant with Modern Authentication" as the authentication method when creating a profile for a device not running the correct software version, users will fall back to the legacy setup assistant Automated Device Enrollment flow.
• For iOS/iPadOS, we recommend selecting to install the Company Portal app from a VPP token in the enrollment profile. When VPP is used, the application can be downloaded and installed without user interaction. When VPP isn't used, an Apple ID is required to install the application. If the user doesn't log into an Apple ID during Setup Assistant they will be prompted to log in when Intune attempts to install the Company Portal.
  • For more information about connecting Intune to Apple Volume Purchase Program (VPP), see Manage Apple volume-purchased apps - Microsoft Intune | Microsoft Docs. Once you have connected to VPP you can add the Company Portal app to your Apple Business Manager/Apple School Manager inventory so it can be assigned through Intune.

Let us know if you have any questions by commenting on this post or reaching out to @IntuneSuppTeam on Twitter.